Executive brief
Dradis Community Edition is a collaboration platform used by IT security teams for vulnerability management and reporting. An authentication bypass vulnerability allows any logged-in (non-admin) user to create AI provider configurations pointing to arbitrary internal or external servers, and then trigger requests to those servers through the AI interface. When the server attempts to process these requests, an attacker can retrieve sensitive information from internal systems like AWS metadata endpoints.
Technical details
The ProvidersController and AgentsController use a conditional authorization check that gates the admin_required before_action on `defined?(Dradis::Pro)`, a constant that does not exist in the Community Edition. This causes the authorization check to be silently skipped, allowing any authenticated user to create AI providers and reassign agents. The vulnerability enables server-side request forgery (SSRF): an attacker can point a provider to an arbitrary HTTP/HTTPS address (including internal link-local hosts such as http://169.254.169.254) and trigger AI interactions that cause the server to make requests to that address. Response bodies from non-2xx responses are reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, allowing information disclosure from internal services. The flaw affects Dradis Community Edition prior to a patched version; authentication is required but admin privileges are not due to the authorization bypass.
Affected products
- Dradis Community Edition prior to patch
Timeline
- 2026-08-25: disclosed
- other: CVE-2026-79788